vendor:
ossec-hids
by:
skynet-13
7,8
CVSS
HIGH
Insecure Temporary File Creation Vulnerability
264
CWE
Product Name: ossec-hids
Affected Version From: 2.8
Affected Version To: 2.8.1
Patch Exists: YES
Related CWE: 2014-5284
CPE: a:ossec:ossec-hids
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Ubuntu x86_64
2014
ossec 2.8 Insecure Temporary File Creation Vulnerability Privilege Escalation
The ossec 2.8 Insecure Temporary File Creation Vulnerability allows an attacker to gain root privileges on the target system by exploiting a vulnerability in the ossec 2.8 software. The vulnerability exists due to the insecure temporary file creation process, which allows an attacker to create a malicious file in the /tmp directory and then execute arbitrary code as root. The attacker can then gain full control of the system.
Mitigation:
The best way to mitigate this vulnerability is to upgrade to the latest version of ossec 2.8.1, which has been patched to address this issue.
